@noodleseed/one 0.133.0 → 0.134.0

package/node_modules/@noodle-borg/assistant-gateway/dist/elevation-store.d.ts

@@ -0,0 +1,70 @@
+import type { TenantRef } from './tenant-ref.js';
+/**
+ * Mid-conversation sign-in on a `mixed` surface (ADR 0201, 5.6b).
+ *
+ * **Not an interaction record, deliberately.** The plan proposed a new `auth_requested` kind on the
+ * existing interaction machinery, but that machinery is *visitor-resolvable*: accept/decline/cancel are
+ * driven from the widget. An elevation resolved by a visitor click would be an elevation with no
+ * credentials, so reusing it would have meant bolting a "this kind is not visitor-resolvable" exception
+ * onto every resolution path and hoping none was missed. A separate record has no such path to forget.
+ *
+ * **The continuation is a capability that travels through the browser**, so possession alone must be
+ * worthless: spending one also requires the customer's client credentials, and the claim checks that the
+ * client's tenant owns the session. It is stored hashed for the same reason session tokens are — the
+ * store never holds a value that could be replayed if it leaked.
+ */
+export interface AssistantElevationRecord {
+    readonly id: string;
+    readonly sessionId: string;
+    readonly tenant: TenantRef;
+    /** The capability the visitor was refused, carried so the audit says what they signed in for. */
+    readonly tool: string;
+    readonly continuationHash: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly claimedAt?: string;
+}
+export type AssistantElevationClaim = {
+    readonly ok: true;
+    readonly elevation: AssistantElevationRecord;
+} | {
+    readonly ok: false;
+    /**
+     * One code per refusal, because they are operationally different: `unknown` is a bad or already
+     * spent continuation, `expired` is a visitor who took too long, and `tenant_mismatch` is a client
+     * spending a continuation for a conversation it does not own — the last is the one worth alerting
+     * on, so it must not collapse into the first.
+     */
+    readonly reason: 'unknown' | 'expired' | 'tenant_mismatch';
+};
+/** Ten minutes: long enough for a real login round trip, short enough that a leaked value is stale. */
+export declare const ASSISTANT_ELEVATION_TTL_MS: number;
+export interface AssistantElevationStore {
+    /**
+     * Open one elevation for a session. At most one may be live at a time — a second request supersedes
+     * the first rather than accumulating, so a model that asks twice cannot mint unbounded capabilities.
+     */
+    request(input: {
+        readonly sessionId: string;
+        readonly tenant: TenantRef;
+        readonly tool: string;
+        readonly now: Date;
+    }): Promise<{
+        readonly elevation: AssistantElevationRecord;
+        readonly continuation: string;
+    }>;
+    /**
+     * Spend a continuation exactly once. Atomic: two backends racing the same value must not both win,
+     * which is why this is one store seam rather than a read-then-write in the route.
+     */
+    claim(input: {
+        readonly continuation: string;
+        readonly tenant: TenantRef;
+        readonly now: Date;
+    }): Promise<AssistantElevationClaim>;
+}
+export declare function elevationContinuation(): string;
+export declare function elevationDigest(value: string): string;
+export declare function elevationHashesEqual(left: string, right: string): boolean;
+export declare function sameTenant(left: TenantRef, right: TenantRef): boolean;
+//# sourceMappingURL=elevation-store.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/elevation.d.ts

@@ -0,0 +1,68 @@
+import type { AssistantPendingResume, AssistantSessionRecord } from './assistant-store.js';
+import type { AssistantElevationStore } from './elevation-store.js';
+import type { TenantRef } from './tenant-ref.js';
+/**
+ * The elevation decision, with no HTTP in it.
+ *
+ * Kept transport-free for the same reason `mintPublicSession` is: the interesting part is an ordering of
+ * refusals, and an ordering is only testable without standing up a server. `packages/service` adapts.
+ *
+ * **The order is the contract.** The continuation is claimed *before* the session is touched, and the
+ * claim is tenant-checked, so a client reaching for a conversation it does not own never reaches the
+ * mutation at all. Claiming first also means a refused elevation cannot leave a spent continuation
+ * behind — and a spent one cannot be replayed, which is the same statement read from the other side.
+ */
+export interface ElevationPorts {
+    readonly elevations: Pick<AssistantElevationStore, 'claim'>;
+    readonly elevateSession: (input: {
+        readonly sessionId: string;
+        readonly caller: AssistantSessionRecord['caller'];
+        readonly clientId: string;
+        readonly origin: string;
+        readonly customerRouting?: AssistantSessionRecord['customerRouting'];
+        readonly pendingResume?: AssistantPendingResume;
+        readonly now: Date;
+    }) => Promise<{
+        readonly ok: true;
+        readonly session: AssistantSessionRecord;
+        readonly token: string;
+    } | {
+        readonly ok: false;
+        readonly reason: 'unknown_session' | 'already_elevated';
+    }>;
+    readonly now: () => Date;
+}
+export interface ElevationRequest {
+    /** Presented by the customer's backend. Possession alone is not enough; see the route. */
+    readonly continuation: string;
+    /** The tenant of the *authenticated client*, never a value the caller supplied loose. */
+    readonly tenant: TenantRef;
+    readonly caller: AssistantSessionRecord['caller'];
+    /** The authenticated client's id: rebinds the session's issuer basis on success (ADR 0152). */
+    readonly clientId: string;
+    /**
+     * Where the conversation continues: allowlist-validated by the route BEFORE the ticket is
+     * claimed, then re-pinned onto the session so its CORS follows the visitor's post-login page.
+     */
+    readonly origin: string;
+    /** Backend-verified customer routes, validated by the route; absent means unchanged. */
+    readonly customerRouting?: AssistantSessionRecord['customerRouting'];
+    /**
+     * Arm the one-shot resume of the intercepted tool on success. Only an explicit `true` arms —
+     * the route owns the default policy, and probes (the doctor's synthetic elevation) pass nothing.
+     */
+    readonly resume?: boolean;
+}
+export type ElevationResult = {
+    readonly ok: true;
+    readonly session: AssistantSessionRecord;
+    readonly token: string;
+    /** What the visitor was refused before signing in, for the audit trail. */
+    readonly tool: string;
+} | {
+    readonly ok: false;
+    readonly status: 403 | 409;
+    readonly code: 'elevation_ticket_invalid' | 'elevation_ticket_expired' | 'elevation_tenant_mismatch' | 'elevation_session_unavailable' | 'elevation_already_signed_in';
+};
+export declare function completeElevation(request: ElevationRequest, ports: ElevationPorts): Promise<ElevationResult>;
+//# sourceMappingURL=elevation.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/embed-script.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The browser embed script, read from the published `@noodleseed/assistant` build.
+ *
+ * Served from the service origin rather than a CDN (ADR 0201): there is no new release lane to run, the
+ * script is always the one that matches the deployed service, and a CDN can front the URL later without
+ * changing a single byte a customer pasted.
+ *
+ * Read once and cached. The file is immutable for the life of the process — it ships inside the image —
+ * so re-reading it per request would buy nothing but syscalls.
+ */
+export interface EmbedScript {
+    readonly bytes: Buffer;
+    /** Content-derived, so a redeployed service with an unchanged bundle keeps browsers' caches warm. */
+    readonly etag: string;
+}
+export type EmbedScriptResult = {
+    readonly ok: true;
+    readonly script: EmbedScript;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+export declare function loadEmbedScript(): EmbedScriptResult;
+//# sourceMappingURL=embed-script.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/embed-store.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Public embed identifiers.
+ *
+ * These live in their own table rather than as a flag on the authenticated `assistant_clients` row, and
+ * the reason is structural rather than tidiness: a public embed id is printed in page source, so it must
+ * never be a credential. A record with no secret column cannot accidentally acquire one — there is
+ * nothing for a future code path to populate, hash, or compare. Reusing the client table would have
+ * inherited its tooling for free while keeping a `secret_hash` one bug away from a public identifier.
+ *
+ * The id is stable across deploys. A customer pastes the snippet once; redeploys and rollbacks swap the
+ * projection underneath a page that never changes. Origins, capabilities, and UI therefore come from the
+ * *active* deployment at mint time, never from the embed record.
+ */
+export interface PublicEmbedRecord {
+    /** Printed in page source. Non-secret by construction. */
+    readonly embedId: string;
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+    /**
+     * Which surface of the assistant this id addresses, so budgets and kill switches key per surface.
+     * Provisioning-time record only: `ensure` never updates a live row, so this goes stale when a
+     * redeploy changes the mode — readers report the active deployment's mode instead.
+     */
+    readonly surfaceMode: 'public' | 'mixed';
+    readonly createdAt: Date;
+    readonly revokedAt?: Date;
+    /**
+     * Operator overrides for this surface's daily caps. Undefined means "use the deployment defaults";
+     * `0` is a real value and is the kill switch, so the two must stay distinguishable everywhere.
+     */
+    readonly turnsPerDay?: number;
+    readonly mintsPerDay?: number;
+}
+/** What an operator may change about a surface. An omitted field leaves that cap as it was. */
+export interface PublicEmbedBudget {
+    readonly turnsPerDay?: number;
+    readonly mintsPerDay?: number;
+}
+export interface PublicEmbedStore {
+    /**
+     * Return the existing id for this tenant surface, or create one. Deploy calls this, so it must be
+     * idempotent: a redeploy that minted a fresh id would silently break every page already carrying the
+     * old one.
+     */
+    ensure(input: {
+        readonly org: string;
+        readonly app: string;
+        readonly env: string;
+        readonly surfaceMode: 'public' | 'mixed';
+        readonly now: Date;
+    }): Promise<PublicEmbedRecord>;
+    /** Resolve an id presented by a browser. Revoked ids resolve to undefined. */
+    lookup(embedId: string): Promise<PublicEmbedRecord | undefined>;
+    /**
+     * Raise, lower, or switch off a surface's daily caps. Separate from `ensure` on purpose: `ensure` runs
+     * on every deploy and never overwrites a live row, so a redeploy cannot reset an operator's decision.
+     */
+    setBudget(embedId: string, budget: PublicEmbedBudget, now: Date): Promise<PublicEmbedRecord | undefined>;
+    list(tenant: {
+        readonly org: string;
+        readonly app: string;
+        readonly env: string;
+    }): Promise<readonly PublicEmbedRecord[]>;
+    revoke(embedId: string, now: Date): Promise<boolean>;
+}
+/**
+ * `pub_` prefixed so it is self-describing in page source, logs, and support threads — someone reading a
+ * customer's HTML can tell at a glance that it is not a secret that leaked.
+ */
+export declare const PUBLIC_EMBED_ID_PREFIX = "pub_";
+export declare function isPublicEmbedId(value: string): boolean;
+//# sourceMappingURL=embed-store.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/in-memory-elevation-store.d.ts

@@ -0,0 +1,21 @@
+import { type AssistantElevationClaim, type AssistantElevationRecord, type AssistantElevationStore } from './elevation-store.js';
+import type { TenantRef } from './tenant-ref.js';
+/** The in-memory half of the pair. Both run the shared parity suite; neither is the only proof. */
+export declare class InMemoryAssistantElevationStore implements AssistantElevationStore {
+    #private;
+    request(input: {
+        readonly sessionId: string;
+        readonly tenant: TenantRef;
+        readonly tool: string;
+        readonly now: Date;
+    }): Promise<{
+        readonly elevation: AssistantElevationRecord;
+        readonly continuation: string;
+    }>;
+    claim(input: {
+        readonly continuation: string;
+        readonly tenant: TenantRef;
+        readonly now: Date;
+    }): Promise<AssistantElevationClaim>;
+}
+//# sourceMappingURL=in-memory-elevation-store.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/in-memory-embed-store.d.ts

@@ -0,0 +1,28 @@
+import { type PublicEmbedBudget, type PublicEmbedRecord, type PublicEmbedStore } from './embed-store.js';
+/** 120 bits of randomness, base36: unguessable enough that an id is never a discovery oracle. */
+export declare function newPublicEmbedId(): string;
+export declare function tenantKey(tenant: {
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+}): string;
+/** Process-local embeds for local development and tests. */
+export declare class InMemoryPublicEmbedStore implements PublicEmbedStore {
+    #private;
+    ensure(input: {
+        readonly org: string;
+        readonly app: string;
+        readonly env: string;
+        readonly surfaceMode: 'public' | 'mixed';
+        readonly now: Date;
+    }): Promise<PublicEmbedRecord>;
+    setBudget(embedId: string, budget: PublicEmbedBudget, _now: Date): Promise<PublicEmbedRecord | undefined>;
+    lookup(embedId: string): Promise<PublicEmbedRecord | undefined>;
+    list(tenant: {
+        readonly org: string;
+        readonly app: string;
+        readonly env: string;
+    }): Promise<readonly PublicEmbedRecord[]>;
+    revoke(embedId: string, now: Date): Promise<boolean>;
+}
+//# sourceMappingURL=in-memory-embed-store.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.d.ts

@@ -0,0 +1,24 @@
+/** Assistant gateway contracts and in-memory adapters safe for the published CLI runtime. */
+export * from './artifact-projection.js';
+export * from './assistant-context.js';
+export * from './assistant-customer-issuer.js';
+export * from './assistant-customer-routing.js';
+export * from './assistant-guide.js';
+export * from './assistant-interaction-state.js';
+export * from './assistant-interactive.js';
+export * from './assistant-presentation.js';
+export * from './assistant-sensitive-values.js';
+export * from './assistant-store.js';
+export * from './elevation.js';
+export * from './elevation-store.js';
+export * from './embed-script.js';
+export * from './embed-store.js';
+export * from './in-memory-elevation-store.js';
+export * from './in-memory-embed-store.js';
+export * from './public-session.js';
+export * from './public-surface.js';
+export * from './public-turn.js';
+export * from './session-resume.js';
+export * from './surface-budget.js';
+export * from './tenant-ref.js';
+//# sourceMappingURL=portable.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/public-session.d.ts

@@ -0,0 +1,56 @@
+import type { AdmissionEnvelope, DailyCounterStore } from '@noodle-borg/admission-limits/portable';
+import { type PublicEmbedRecord, type PublicEmbedStore } from './embed-store.js';
+import type { PublicSurface } from './public-surface.js';
+/**
+ * Minting an anonymous session for a public page.
+ *
+ * Transport-free on purpose: the hosting service owns the HTTP adapter (parse body, map result), and
+ * everything that decides *whether* a stranger gets a session lives here, behind narrow ports. That is
+ * what keeps the decision testable without a server and the service-side residue to a few lines.
+ *
+ * The refusal order is part of the contract, not an implementation detail. ADR 0201 §8 requires
+ * admission to complete before any metered work, so the store-durability and budget checks come before
+ * anything that would read deployment state or reach a model.
+ */
+export interface PublicSessionPorts {
+    readonly embeds: Pick<PublicEmbedStore, 'lookup'>;
+    readonly counters: DailyCounterStore;
+    /** The live surface for this tenant, read from the *active* deployment at mint time. */
+    resolveActiveSurface(embed: PublicEmbedRecord): Promise<PublicSurface | undefined>;
+    /** Persist the anonymous session and return its bearer token and expiry. */
+    createSession(input: {
+        readonly embed: PublicEmbedRecord;
+        readonly origin: string;
+        readonly subject: string;
+        readonly envelope: AdmissionEnvelope;
+    }): Promise<{
+        readonly token: string;
+        readonly expiresAt: string;
+    }>;
+    /** Opaque, deployment-scoped, unlinkable to any person. */
+    newAnonymousSubject(): string;
+    now(): Date;
+}
+export interface PublicSessionRequest {
+    readonly embedId: unknown;
+    readonly origin: unknown;
+    /**
+     * The visitor's address bucket (admission tier 3), already hashed by the transport — a raw address
+     * must never reach this decision, a counter key, or an audit payload. Absent when ingress could not
+     * be parsed, in which case the surface tier alone applies: fairness degrades, solvency does not.
+     */
+    readonly addressBucket?: string | undefined;
+}
+export type PublicSessionResult = {
+    readonly ok: true;
+    readonly token: string;
+    readonly expiresAt: string;
+    readonly embed: PublicEmbedRecord;
+} | {
+    readonly ok: false;
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+};
+export declare function mintPublicSession(request: PublicSessionRequest, envelope: AdmissionEnvelope, ports: PublicSessionPorts): Promise<PublicSessionResult>;
+//# sourceMappingURL=public-session.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/public-surface.d.ts

@@ -0,0 +1,21 @@
+import type { SurfaceCapabilityRef } from './artifact-projection.js';
+/**
+ * The one reader of "does this deployment face the public, and on what terms".
+ *
+ * Three callers ask that question and must never disagree: deploy decides whether to provision an embed
+ * id, minting checks the browser's origin against the surface, and the session's projection narrows the
+ * artifact to the surface's capabilities. When each answered locally, a surface shape one of them
+ * accepted and another rejected would silently mint sessions that could reach nothing, or provision an id
+ * for a surface that refuses to serve it.
+ *
+ * The argument is `unknown` because the assistant block arrives as compiled artifact data rather than a
+ * typed authoring value; the shape is validated here, once, rather than asserted at three call sites.
+ */
+export interface PublicSurface {
+    readonly mode: 'public' | 'mixed';
+    readonly origins: readonly string[];
+    readonly capabilities: readonly SurfaceCapabilityRef[];
+    readonly instructions?: string;
+}
+export declare function publicSurfaceOf(assistant: unknown): PublicSurface | undefined;
+//# sourceMappingURL=public-surface.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/public-surface.js

@@ -3,7 +3,7 @@ export function publicSurfaceOf(assistant) {
     if (!Array.isArray(surfaces))
         return undefined;
     for (const entry of surfaces) {
-        const { mode, origins, capabilities } = entry;
+        const { mode, origins, capabilities, instructions } = entry;
         // A mixed surface admits strangers exactly as a public one does — sign-in only widens what a visitor
         // reaches after elevation, so both provision an embed id and both project.
         if (mode !== 'public' && mode !== 'mixed')
@@ -17,6 +17,7 @@ export function publicSurfaceOf(assistant) {
             capabilities: Array.isArray(capabilities)
                 ? capabilities
                 : [],
+            ...(typeof instructions === 'string' ? { instructions } : {}),
         };
     }
     return undefined;

package/node_modules/@noodle-borg/assistant-gateway/dist/public-turn.d.ts

@@ -0,0 +1,44 @@
+import type { AdmissionEnvelope, DailyCounterStore } from '@noodle-borg/admission-limits/portable';
+import type { AssistantTurnConsumption } from './assistant-store.js';
+import type { PublicEmbedStore } from './embed-store.js';
+/**
+ * Whether an anonymous visitor's next turn runs.
+ *
+ * Transport-free for the same reason {@link ./public-session.ts} is: the decision about who gets to spend
+ * a customer's model budget should be provable without standing up a server. The service adapts it.
+ *
+ * The envelope arrives per call rather than being snapshotted onto the session at mint time, and that is
+ * load-bearing: `noodle assistant budget set --turns-per-day 0` must stop conversations already under
+ * way, which is precisely the case an operator reaches for the kill switch to stop. Re-reading it each
+ * turn makes the switch fall out of the ordinary path instead of needing a second mechanism.
+ */
+export interface PublicTurnPorts {
+    readonly counters: DailyCounterStore;
+    /** Re-read per turn: it carries the operator's live budget, and whether the surface still exists. */
+    readonly embeds: Pick<PublicEmbedStore, 'lookup'>;
+    /** Spend one of this session's turns, atomically (admission tier 1). */
+    consumeTurn(id: string, limit: number): Promise<AssistantTurnConsumption>;
+    now(): Date;
+}
+export interface PublicTurnRequest {
+    readonly sessionId: string;
+    /** The surface the session was admitted through; daily spend is charged against it. */
+    readonly publicEmbedId: string;
+    readonly message: string;
+    /**
+     * The visitor's hashed address bucket (admission tier 3), or absent when ingress could not be parsed.
+     * A raw address must never reach this decision, a counter key, or an audit payload.
+     */
+    readonly addressBucket?: string | undefined;
+}
+export type PublicTurnResult = {
+    readonly ok: true;
+    readonly turnCount: number;
+} | {
+    readonly ok: false;
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+};
+export declare function admitPublicTurn(request: PublicTurnRequest, defaults: AdmissionEnvelope, ports: PublicTurnPorts): Promise<PublicTurnResult>;
+//# sourceMappingURL=public-turn.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/session-resume.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The post-sign-in resume decision and its platform message (issue #1177). When a spent ticket
+ * elevates a session, the service may run one assistant turn so the model re-attempts the
+ * intercepted intent under the new principal — the visitor signed in to get an answer, and the
+ * panel's first content should be that answer, not silence. Transport-free like the elevation
+ * decision; `packages/service` adapts.
+ */
+/**
+ * Whether a successful elevation arms the one-shot resume. ON by default — the demo-magic case is
+ * the default experience — with the exchange-side `resume: false` as the single disable knob (it
+ * lives in the integrator's own session endpoint, the code that spends the ticket).
+ */
+export declare function shouldAutoResume(override: boolean | undefined): boolean;
+/**
+ * The `[platform]` message that drives the resume turn, persisted to history as a user-role
+ * message like the interaction-resolution narration. It must countermand the interception's own
+ * guidance ("ask them to sign in, then offer to try again") — the sign-in already happened, and
+ * asking the visitor to repeat themselves is the silence this feature removes. Arguments are not
+ * replayed: the model re-derives them from history under the new principal.
+ */
+export declare function resumeTurnMessage(tool: string): string;
+//# sourceMappingURL=session-resume.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/surface-budget.d.ts

@@ -0,0 +1,16 @@
+import { type AdmissionEnvelope } from '@noodle-borg/admission-limits/portable';
+import type { PublicEmbedRecord } from './embed-store.js';
+/**
+ * One surface's daily budget, resolved from the operator's override and the deployment's defaults.
+ *
+ * Per surface rather than per service, because the question a customer actually asks is "does capping
+ * my marketing bot throttle my in-app assistant" — and the answer has to be an obvious no. The override
+ * lives on the embed row, which `ensure` never overwrites, so a redeploy cannot silently reset a kill
+ * switch someone reached for.
+ *
+ * Routed through `clamp` rather than used directly: the structural maximum is not negotiable by an
+ * operator any more than by app code, so an over-eager `--turns-per-day 999999999` degrades to the
+ * ceiling instead of becoming the ceiling. Zero survives clamping and is the kill switch.
+ */
+export declare function surfaceEnvelope(base: AdmissionEnvelope, embed: Pick<PublicEmbedRecord, 'turnsPerDay' | 'mintsPerDay'>): AdmissionEnvelope;
+//# sourceMappingURL=surface-budget.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/surface-budget.js

@@ -1,4 +1,4 @@
-import { clamp } from '@noodle-borg/admission-limits';
+import { clamp } from '@noodle-borg/admission-limits/portable';
 /**
  * One surface's daily budget, resolved from the operator's override and the deployment's defaults.
  *

package/node_modules/@noodle-borg/assistant-gateway/dist/tenant-ref.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The tenant coordinate an assistant session is bound to.
+ *
+ * Structurally re-declared rather than imported: `packages/service`'s `store.ts` remains the canonical
+ * definition, but the gateway must not depend on the hosted service (the dependency runs the other way).
+ * The two shapes are identical by contract — widen them together.
+ */
+export interface TenantRef {
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+}
+//# sourceMappingURL=tenant-ref.d.ts.map

package/node_modules/@noodle-borg/authoring/dist/assistant.d.ts

@@ -143,6 +143,7 @@ export type AssistantSurfaceMode = 'authenticated' | 'public' | 'mixed';
 export interface AuthenticatedWebsiteAccess {
     readonly mode: 'authenticated';
     readonly origins: readonly string[];
+    readonly instructions?: string;
     /** Allowlist of verified session claims; undeclared claims are dropped at session exchange. */
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
     readonly capabilities?: readonly CapabilityRef[];
@@ -151,16 +152,21 @@ export interface PublicWebsiteAccess {
     readonly mode: 'public' | 'mixed';
     readonly origins: readonly string[];
     readonly capabilities: readonly CapabilityRef[];
+    readonly instructions?: string;
 }
 export type AssistantAccess = AuthenticatedWebsiteAccess | PublicWebsiteAccess;
 export interface AuthenticatedWebsiteInput {
     readonly origins: readonly (string | ConfigRef)[];
+    /** Assistant-only behavior for this exact signed-in website audience. */
+    readonly instructions?: string;
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
     /** Optional narrowing; omitted means the signed-in surface projects the whole server. */
     readonly capabilities?: readonly CapabilityRef[];
 }
 export interface PublicWebsiteInput {
     readonly origins: readonly (string | ConfigRef)[];
+    /** Assistant-only behavior for anonymous visitors on this website surface. */
+    readonly instructions?: string;
     /**
      * Required: on a public page this list *is* the externally reachable surface, so it must be an
      * explicit positive choice rather than whatever the server happens to declare.
@@ -186,6 +192,7 @@ export interface EmbeddedAssistantOptions extends AssistantUiOptions {
 export interface AssistantSurfaceConfig {
     readonly mode: AssistantSurfaceMode;
     readonly origins: readonly string[];
+    readonly instructions?: string;
     readonly capabilities?: readonly AssistantCapability[];
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
 }

package/node_modules/@noodle-borg/authoring/dist/assistant.js

@@ -3,6 +3,7 @@ export function authenticatedWebsite(input) {
     return {
         mode: 'authenticated',
         origins: serializeOrigins(input.origins, 'assistant.access.origins'),
+        ...(input.instructions === undefined ? {} : { instructions: input.instructions }),
         ...(input.sessionClaims ? { sessionClaims: structuredClone(input.sessionClaims) } : {}),
         ...(input.capabilities ? { capabilities: [...input.capabilities] } : {}),
     };
@@ -12,6 +13,7 @@ export function publicWebsite(input) {
         mode: input.signIn === true ? 'mixed' : 'public',
         origins: serializeOrigins(input.origins, 'assistant.access.origins'),
         capabilities: [...input.capabilities],
+        ...(input.instructions === undefined ? {} : { instructions: input.instructions }),
     };
 }
 function serializeOrigins(origins, path) {
@@ -42,6 +44,7 @@ export function embeddedAssistant(input) {
         surfaces: surfaces.map((surface) => ({
             mode: surface.mode,
             origins: [...surface.origins],
+            ...(surface.instructions === undefined ? {} : { instructions: surface.instructions }),
             ...(surface.capabilities
                 ? { capabilities: normalizeCapabilities(surface.capabilities) }
                 : {}),

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.d.ts

@@ -339,6 +339,7 @@ export declare const manifestV1Schema: z.ZodObject<{
                     mixed: "mixed";
                 }>;
                 origins: z.ZodArray<z.ZodString>;
+                instructions: z.ZodOptional<z.ZodString>;
                 capabilities: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     kind: z.ZodEnum<{
                         tool: "tool";
@@ -789,6 +790,7 @@ export declare const manifestV2Schema: z.ZodObject<{
                     mixed: "mixed";
                 }>;
                 origins: z.ZodArray<z.ZodString>;
+                instructions: z.ZodOptional<z.ZodString>;
                 capabilities: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     kind: z.ZodEnum<{
                         tool: "tool";
@@ -1449,6 +1451,7 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                     mixed: "mixed";
                 }>;
                 origins: z.ZodArray<z.ZodString>;
+                instructions: z.ZodOptional<z.ZodString>;
                 capabilities: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     kind: z.ZodEnum<{
                         tool: "tool";
@@ -1898,6 +1901,7 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                     mixed: "mixed";
                 }>;
                 origins: z.ZodArray<z.ZodString>;
+                instructions: z.ZodOptional<z.ZodString>;
                 capabilities: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     kind: z.ZodEnum<{
                         tool: "tool";

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.js

@@ -334,6 +334,11 @@ const assistantCapabilitySchema = z
     name: z.string().trim().min(1),
 })
     .strict();
+/**
+ * Upper bound on server- and surface-level instructions. These are concise behavior primers, not
+ * documentation; the shared cap keeps prompt ownership predictable across both layers.
+ */
+const MAX_SERVER_INSTRUCTIONS = 4000;
 /** Verified session claims an embedding backend may pass at exchange; undeclared keys are dropped. */
 const sessionClaimsSchema = z.record(z.string().regex(/^[A-Za-z][A-Za-z0-9_]{0,63}$/, 'claim keys are identifier-style'), z.object({ exposeToModel: z.boolean().optional() }).strict());
 const embeddedAssistantSchema = z
@@ -356,6 +361,7 @@ const embeddedAssistantSchema = z
         .object({
         mode: z.enum(['authenticated', 'public', 'mixed']),
         origins: z.array(assistantOriginOrVariableSchema).min(1),
+        instructions: z.string().trim().min(1).max(MAX_SERVER_INSTRUCTIONS).optional(),
         capabilities: z.array(assistantCapabilitySchema).optional(),
         sessionClaims: sessionClaimsSchema.optional(),
     })
@@ -427,11 +433,6 @@ const serverShellSchema = z
     persistentActions: z.array(serverShellActionSchema).optional(),
 })
     .strict();
-/**
- * Upper bound on `server.instructions`. Hosts inject instructions into every session's context, so the
- * field is for a concise usage primer (a few hundred words), not documentation.
- */
-const MAX_SERVER_INSTRUCTIONS = 4000;
 const serverContextSchema = z
     .object({
     defaults: z